The overwhelming majority of intrusions come from categories that generic best-practice spending doesn't typically address, let alone take into consideration.